CVE-2019-1003089: Medium severity pgyer codefever vulnerability
Published Apr 4, 2019
·Updated
Jenkins Upload to pgyer Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Affected Software
1 affected component
jenkins Upload To Pgyer Jenkins<=1.31
Event History
Apr 4, 2019
CVE Published
via MITRE·03:38 PM
Data Sourced
via MITRE·03:38 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-1003089?
CVE-2019-1003089 has a medium severity rating due to the unencrypted storage of sensitive credentials.
2
How do I fix CVE-2019-1003089?
To fix CVE-2019-1003089, you should upgrade the Upload to pgyer Plugin to version 1.32 or later.
3
What type of data is affected by CVE-2019-1003089?
CVE-2019-1003089 affects sensitive credentials that are stored unencrypted in job config.xml files.
4
Who can access the credentials exposed by CVE-2019-1003089?
Users with Extended Read permission or access to the Jenkins master file system can view the exposed credentials.
5
Can CVE-2019-1003089 lead to data breaches?
Yes, CVE-2019-1003089 can potentially lead to data breaches if unauthorized users gain access to the stored credentials.